TAMECAT PowerShell Backdoor Targets Edge and Chrome: Login Credentials At Risk

TAMECAT is a sophisticated PowerShell backdoor attributed to Iranian APT42 and observed in the SpearSpecter campaign; it uses a VBScript downloader and an AES-encrypted loader to deploy modular components that steal Edge and Chrome credentials via browser debugging, execute commands received from Telegram-based C2, and perform in-memory execution and exfiltration. The report provides IoCs (SHA256/SHA1/MD5 hashes, domains), C2 behavior, MITRE ATT&CK mappings, and mitigation recommendations including EDR/AV, PowerShell logging, and tighter browser security monitoring.